Pass is a simple password manager that strictly follows the Unix philosophy. It simply provides a directory structure of GPG encrypted files containing passwords and other information for each password. In this post, I will go over how to initialize Pass and different ways of interacting with it.
If you don’t have a GPG key, we need to generate one with:
In order to use this key with Pass, run the command:
gpg --list-secret-keys --keyid-format LONG
This will show details of your key. Look for a line that looks something like this:
sec rsa2048/0D2740AEE2FAEA2B 2021-01-07 [SC]
We need to copy the string after the line
rsa2048/ until the date. With this, we can
create our password store by running:
pass init "0d2740AEE2FAEA2B"
Now we have created our password store and can start adding passwords to it by doing:
pass insert <CATEGORY>/<SUBCATEGORY>/<NAME>
For example, to add an entry for an email address we would enter:
pass insert email@example.com
This will prompt us to enter a password and the contents will be saved into a GPG
protected file with our key. The location of this file will be in
In order to decrypt this file and get its content, we can run:
This will echo the output in the terminal.
Now we have a GPG encrypted file that contains your password. To add other information to this file such as a username and URI, we can run:
pass edit firstname.lastname@example.org
Since this is just a GPG encrypted file, you are free to edit it to your liking, but the preferred organizational scheme used by the author of Pass looks like this:
Secret Question 1: What is your childhood best friend's most bizarre superhero fantasy? Oh god, Amazon, it's too awful to say...
Phone Support PIN #: 84719
Pass-otp is an extension for pass that allows for two-factor authentication support. To add an OTP secret to our account, we can run:
pass otp append -a -s email@example.com
You can also get the OTP secret from a QR code by running:
zbarimg -q --raw qrcode.png | pass otp insert totp-secret
Frontends to Pass
To interact with pass outside the terminal, there are a couple helpful extensions. Since
I use dmenu there is a dmenu script that comes with Pass. You can run it with
as long as you have dmenu installed.
There is also an Emacs package called
password-store which allows you to copy
passwords to your kill-ring from Emacs. I use both of these frontends depending on my
To learn more about Pass, you can check the official website at . They also have a list of other extensions and conversion tools to migrate from other password managers.